Cybersecurity Incident Reports And Lessons Learned From Recent Court Decisions Ordering Their Disclosure

The rapid rise of cybersecurity incidents, and the litigation and government investigations that often ensue, have resulted in many hotly contested disputes concerning the disclosure of documents explaining 'what happened' and 'how.' In the past year, at least three courts have weighed in to resolve such disputes, each of which required disclosure.

In some cases, being ordered to disclose such documents can be problematic. Incident response reports, including those concerning forensic investigations and root cause analyses, can lay bare how and why certain systems were vulnerable to cyberattacks in the first place, potentially giving rise to or supporting claims of negligence and statutory violations.